CVE-2025-6519

CVE Enrichment

CVSS: 9.3 CRITICAL
EPSS: 0.54%
EPSS Percentile: 45.63%
CISA KEV: Not listed

Description

E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated password. An attacker can predictably generate the password for ONEDAY. The oneday user cannot be deleted or modified by any user.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: dd59f033-460c-4b88-a075-d4d3fedb6191
Published: 02-Sep-2025 19:15
Last Modified: 24-Oct-2026 05:10
EPSS Date: 2026-11-09
CWE: CWE-522

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:N /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:N /
                            SI:L /
                            SA:L /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

CNA Products / Version Status

Copeland LP · E3 Supervisory Control Source: CNA · dd59f033-460c-4b88-a075-d4d3fedb6191
Default status: affected

0 ≤ version < 2.31F01 — affected (firmware)

Affected Products / Versions

copeland / e3_supervisory_controller_firmware Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 2.31f01
cpe:2.3:o:copeland:e3_supervisory_controller_firmware:*:*:*:*:*:*:*:*

References

dd59f033-460c-4b88-a075-d4d3fedb6191

Last enrichment sync: 10-Nov-2026 07:34
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

CVE-2025-6519, CVE-2025-52543 to CVE-2025-52551 (Frostbyte10) Copeland E3 Site Supervisor and E2 Ten flaws found by Armis that chain to unauthenticated remote code execution as root E3 firmware 2.31F01; E2 is end of life Refrigeration Controller Attacks Spread Across Countries, Attribution Remains Unclear

CVE (6)

Threat Actors (5)

MITRE ATT&CK (8)

Vendors (4)

Products (10)

Tools (1)

Industries (6)

Countries (9)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.